linux/drivers/nvme/host
Ruozhu Li 8b77fa6fdc nvme: fix use after free when disconnecting a reconnecting ctrl
A crash happens when trying to disconnect a reconnecting ctrl:

 1) The network was cut off when the connection was just established,
    scan work hang there waiting for some IOs complete.  Those I/Os were
    retried because we return BLK_STS_RESOURCE to blk in reconnecting.
 2) After a while, I tried to disconnect this connection.  This
    procedure also hangs because it tried to obtain ctrl->scan_lock.
    It should be noted that now we have switched the controller state
    to NVME_CTRL_DELETING.
 3) In nvme_check_ready(), we always return true when ctrl->state is
    NVME_CTRL_DELETING, so those retrying I/Os were issued to the bottom
    device which was already freed.

To fix this, when ctrl->state is NVME_CTRL_DELETING, issue cmd to bottom
device only when queue state is live.  If not, return host path error to
the block layer

Signed-off-by: Ruozhu Li <liruozhu@huawei.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
2021-12-07 18:21:16 +01:00
..
core.c nvme: fix use after free when disconnecting a reconnecting ctrl 2021-12-07 18:21:16 +01:00
fabrics.c nvme-fabrics: ignore invalid fast_io_fail_tmo values 2021-11-23 17:22:41 +01:00
fabrics.h nvme: display correct subsystem NQN 2021-10-20 19:16:02 +02:00
fault_inject.c nvme: enable to inject errors into admin commands 2019-06-21 11:15:50 +02:00
fc.c for-5.16/drivers-2021-10-29 2021-11-01 09:27:38 -07:00
fc.h nvme-fc: Update header and host for common definitions for LS handling 2020-05-09 16:18:33 -06:00
hwmon.c nvme-hwmon: Return error code when registration fails 2021-03-05 13:41:03 +01:00
ioctl.c remove the lightnvm subsystem 2021-08-14 15:54:09 -06:00
Kconfig nvme: Have NVME_FABRICS select NVME_CORE instead of transport drivers 2021-08-16 21:03:18 +02:00
Makefile remove the lightnvm subsystem 2021-08-14 15:54:09 -06:00
multipath.c nvme-multipath: set ana_log_size to 0 after free ana_log_buf 2021-12-07 18:19:28 +01:00
nvme.h nvme: fix use after free when disconnecting a reconnecting ctrl 2021-12-07 18:21:16 +01:00
pci.c for-5.16/drivers-2021-10-29 2021-11-01 09:27:38 -07:00
rdma.c for-5.16/drivers-2021-10-29 2021-11-01 09:27:38 -07:00
tcp.c nvme-tcp: fix memory leak when freeing a queue 2021-11-23 17:22:41 +01:00
trace.c nvme: add set feature tracing support 2021-08-16 14:42:23 +02:00
trace.h nvme: fix nvme_setup_command metadata trace event 2021-07-21 09:55:44 +02:00
zns.c nvme: report write pointer for a full zone as zone start + zone len 2021-12-06 08:52:08 +01:00